Cross-reference
NIST AI RMF 1.0
72 items: 47 met directly by a control at Level 3, 25 partly, 0 deliberately out of scope.
| Ref | Item (our description) | Controls | Note |
|---|---|---|---|
| GOVERN 1.1 | Understand, manage and document the legal and regulatory requirements for AI | RSK-04 direct, STR-05 partial | |
| GOVERN 1.2 | Build the characteristics of trustworthy AI into policies and processes | RSK-05 partial, GOV-01 partial | Adopted principles are applied through a review route (RSK-05) and the policy sets permitted uses (GOV-01); no control requires the trustworthy characteristics (valid and reliable, safe, secure, accountable, explainable, privacy, fair) to be written into policies and procedures as a set. |
| GOVERN 1.3 | Scale risk management effort to the organisation's risk tolerance | RSK-02 direct, RSK-01 direct, GOV-03 partial | |
| GOVERN 1.4 | Set up the risk management process through clear policies and procedures | RSK-02 direct, GOV-01 partial, GOV-07 partial | |
| GOVERN 1.5 | Plan ongoing monitoring and periodic review of the risk management process | MON-07 partial, MON-05 partial, RSK-01 partial | MON-07 re-runs this assessment on a cycle (which includes the RSK controls), MON-05 reviews individual uses and independently audits the governance arrangements as a whole on a set cycle, and RSK-01 has a review date. Still missing is planned ongoing monitoring of the risk management process and its outcomes between audits, with defined roles for it. |
| GOVERN 1.6 | Keep an inventory of AI systems, resourced by risk priority | GOV-06 direct | |
| GOVERN 1.7 | Decommission and phase out AI systems safely | POR-09 direct, DAT-06 partial | |
| GOVERN 2.1 | Document roles, responsibilities and lines of communication for AI risk | GOV-05 direct, GOV-04 partial, GOV-03 partial | |
| GOVERN 2.2 | Train staff and partners in AI risk management for their duties | PPL-05 direct, PPL-01 partial, PPL-02 partial | PPL-05 Level 3 covers specific risk management duties in role pathways and extends them to suppliers and contractors where they operate AI for the organisation; PPL-01 reaches contractors and others operating AI on its behalf. |
| GOVERN 2.3 | Executive leadership owns decisions about AI risk | GOV-02 direct, RSK-01 partial, GOV-03 partial | |
| GOVERN 3.1 | A diverse team informs AI risk decisions across the lifecycle | GOV-04 direct, OPM-06 partial, PPL-07 partial | The oversight forum (GOV-04) brings diverse demographic backgrounds and lived experience as well as disciplines; delivery teams are multidisciplinary and include subject matter experts (OPM-06), and the recruitment plan covers the diversity of AI teams (PPL-07). |
| GOVERN 3.2 | Define roles for human-AI configurations and human oversight | RSK-07 direct, GOV-05 partial, OPM-06 partial, STR-02 partial | RSK-07 sets the oversight model and reviewer roles for each use and GOV-05 names owners; OPM-06 delivery standards cover the design of how people and AI share work, and STR-02 names the kinds of decision that must always be taken by a person. |
| GOVERN 4.1 | Foster critical thinking and a safety-first mindset around AI | CUL-04 partial, CUL-05 partial, RSK-05 partial, PPL-01 partial, SEC-06 partial, OPM-06 partial | No-blame concern raising (CUL-04), learning from failure (CUL-05), ethical review (RSK-05) and literacy (PPL-01) build the culture; SEC-06 tests generative AI against attempts to bypass safeguards and requires security testing independent of the build team for higher-risk uses, and OPM-06 requires safety by design. Independent challenge of designs and a safety-first mindset in use are not explicit. |
| GOVERN 4.2 | Teams document the risks and impacts of the AI they build or use and communicate them | RSK-02 direct, RSK-03 direct, GOV-09 partial | |
| GOVERN 4.3 | Practices that enable AI testing, incident identification and information sharing | TEC-06 partial, MON-04 partial, MON-09 partial, SEC-05 partial, OPM-08 partial | Met by several controls together rather than one; testing (TEC-06), incidents (MON-04, SEC-05) and sharing with peers (OPM-08) each cover a part. MON-09 sets routes for notifying suppliers and regulators of serious incidents; wider sharing of incident information outside the organisation is not explicit. |
| GOVERN 5.1 | Gather and act on outside feedback about individual and societal impacts | CUL-08 direct, MON-06 partial, STR-07 partial | |
| GOVERN 5.2 | Feed reviewed feedback regularly into system design and implementation | MON-06 direct, CUL-03 partial, OPM-06 partial | |
| GOVERN 6.1 | Policies for third-party AI risks, including intellectual property infringement | RSK-09 direct, OPM-04 partial, SEC-03 partial, DAT-08 partial | |
| GOVERN 6.2 | Contingency plans for failures in high-risk third-party data or AI | OPM-09 direct, OPM-05 partial, MON-04 partial | |
| MAP 1.1 | Document the intended purpose, setting, users, norms and expected impacts of a system | POR-05 partial, RSK-03 partial, RSK-04 partial, GOV-06 partial | The business case (purpose, benefits, assumptions), impact assessment (effects on people and society), obligations register (laws) and inventory (purpose) each hold part of the context; a single documented context for each system covering users, deployment setting and limitations is system-level. |
| MAP 1.2 | Context is set by diverse, interdisciplinary people whose involvement is recorded | OPM-06 partial, OPM-10 partial, CUL-03 partial, GOV-04 partial, PPL-07 partial | Multidisciplinary teams that include subject matter experts for the data and the work (OPM-06) and staff involvement (CUL-03) bring a range of disciplines and experience; the oversight forum brings diverse backgrounds and lived experience (GOV-04), the recruitment plan covers the diversity of AI teams (PPL-07), OPM-06 considers diversity of perspective for each team, and OPM-10 records input from affected communities and outside experts for significant uses. Still missing: recording who took part in setting the context for each use. |
| MAP 1.3 | Document the organisation's mission and goals for AI | STR-01 direct | |
| MAP 1.4 | Define the business value, or re-evaluate it for existing systems | POR-05 direct, STR-04 partial, MON-03 partial | |
| MAP 1.5 | Set and document risk tolerances | RSK-01 direct | |
| MAP 1.6 | Elicit system requirements and account for socio-technical effects in design | OPM-06 partial, POR-05 partial, RSK-03 partial | User-centred delivery standards (OPM-06), the business case (POR-05) and the impact assessment (RSK-03) shape requirements; documented system requirements are system-level. |
| MAP 2.1 | Define the tasks the system supports and the AI methods used | GOV-06 partial, POR-05 partial | The inventory and business case record purpose; recording the AI technique used for each system (classifier, generative, recommender) is system-level and not required. |
| MAP 2.2 | Document the system's knowledge limits and how people use and oversee its output | TEC-05 direct, RSK-07 partial | TEC-05 Level 3 requires documentation for each version to state known limitations and where the AI must not be used or relied on, and RSK-07 sets how output is used and overseen by people. |
| MAP 2.3 | Identify scientific integrity and test and evaluation considerations | TEC-06 partial, DAT-03 partial, DAT-08 partial | System-level; representative test data (TEC-06), data quality (DAT-03) and provenance (DAT-08) are covered, but experimental design and construct validity are not. |
| MAP 3.1 | Examine and document expected benefits | POR-05 direct, STR-04 partial | |
| MAP 3.2 | Examine the costs of AI errors, including non-monetary ones, against risk tolerance | POR-05 partial, RSK-02 partial, RSK-03 partial | The business case covers financial costs (POR-05) and the risk and impact assessments cover harms (RSK-02, RSK-03); assessing the cost of the system's errors against risk tolerance is not explicit. |
| MAP 3.3 | Specify and document the targeted scope of application | TEC-06 direct, GOV-03 partial, GOV-06 partial, TEC-01 partial | TEC-06 Level 3 requires intended operating conditions (where, when and on what inputs the AI can be relied on) to be defined before testing, given to operators and risk owners, and enforced by limits, which is the targeted scope based on tested capability; approval sets the purpose (GOV-03) and the inventory records it with its risk classification (GOV-06). |
| MAP 3.4 | Define and assess operator and practitioner proficiency | PPL-05 direct, PPL-04 partial, RSK-07 partial | |
| MAP 3.5 | Define, assess and document human oversight processes | RSK-07 direct | |
| MAP 4.1 | Map technology and legal risks of components, including third-party data, software and IP | RSK-02 partial, RSK-09 partial, SEC-03 partial, DAT-08 partial, OPM-04 partial | Risks are assessed for each use (RSK-02) and for bought AI (RSK-09), external components are security checked (SEC-03) and data rights recorded (DAT-08); mapping legal and IP risks for each component, including open-source models taken without a contract, is system-level and not explicit. |
| MAP 4.2 | Identify and document internal risk controls for system components | RSK-02 partial, SEC-03 partial, RSK-09 partial | RSK-02 records the controls applied for each use of AI; recording them for each component, including third-party models, is system-level. |
| MAP 5.1 | Judge the likelihood and size of each beneficial and harmful impact | RSK-03 direct, RSK-02 partial, POR-05 partial | |
| MAP 5.2 | Regular engagement with AI actors and feedback on impacts | MON-06 direct, CUL-03 partial, CUL-08 partial | |
| MEASURE 1.1 | Choose measures for the most significant risks first and record what cannot be measured | MON-01 partial, TEC-06 partial, RSK-06 partial | Measures cover accuracy, outcome and effect on people (MON-01), test criteria (TEC-06) and fairness (RSK-06), and MON-01 records risks that cannot yet be measured with their proxy indicators. Still missing: choosing measures for each assessed risk in order of significance. |
| MEASURE 1.2 | Regularly review whether metrics fit and controls work | MON-05 partial, GOV-08 partial, MON-07 partial, TEC-06 partial | Independent assurance (MON-05), compliance checks (GOV-08) and the maturity re-assessment (MON-07) test whether controls work, and TEC-06 reviews test metrics on a set cycle against live performance and incidents. Regularly reviewing whether the live measures for each use (MON-01) are still the right ones is not explicit. |
| MEASURE 1.3 | Independent assessors and outside experts take part in regular assessments | MON-05 direct, CUL-03 partial, MON-06 partial | |
| MEASURE 2.1 | Document test sets, metrics and tools used in testing | TEC-06 partial | System-level; TEC-06 records results and criteria, but documenting the test sets and tools used is not explicit. |
| MEASURE 2.2 | Evaluations with human participants are protected and representative | OPM-10 direct, RSK-05 partial, DAT-05 partial | OPM-10 Level 3 requires evaluations and user research involving people to have informed consent, ethics review through the established route and participants who represent the people the service will serve, and protects their wellbeing and right to withdraw. |
| MEASURE 2.3 | Measure performance against criteria in conditions like live use | TEC-06 direct, MON-01 partial | |
| MEASURE 2.4 | Monitor system behaviour in production | MON-02 direct | |
| MEASURE 2.5 | Show the system is valid and reliable and record limits on generalising | TEC-06 direct, TEC-05 partial | TEC-06 Level 3 tests accuracy and robustness before release and defines the operating conditions in which the AI can be relied on; TEC-05 documentation states known limitations and where the AI must not be relied on, which records the limits beyond the tested conditions. |
| MEASURE 2.6 | Evaluate safety regularly, keep residual risk in tolerance and fail safely | TEC-06 partial, OPM-09 partial, MON-02 partial, RSK-01 partial, RSK-02 partial, GOV-07 partial, GOV-03 partial | Safe stop and fallback (OPM-09, tested on a set cycle at Level 3), live monitoring (MON-02) and pre-release testing (TEC-06) are covered, and RSK-02 reassesses risk during live use and records residual risk. GOV-07 requires a hazard analysis for uses that could contribute to physical harm and TEC-06 enforces operating conditions by limits, and GOV-03 refuses or stops a use whose residual risk cannot be brought within the risk appetite. Still missing: safety evaluation as such on a regular cycle. |
| MEASURE 2.7 | Evaluate and document security and resilience | SEC-06 direct, TEC-06 partial, SEC-01 partial, SEC-02 partial, SEC-05 partial | SEC-06 Level 3 requires security testing against the threats in the threat model, by testers with the right skills, independent of the build team for higher-risk uses, and TEC-06 records test results before release; SEC-02 supplies the threat model, SEC-01 adds security monitoring of live use and SEC-05 recovery from AI-specific attacks, exercised at Level 3. Detailed security test methods remain delegated to the baseline. |
| MEASURE 2.8 | Examine and document transparency and accountability risks | GOV-09 partial, RSK-08 partial, GOV-05 partial | Published records (GOV-09), explanation to affected people (RSK-08) and named owners (GOV-05) provide transparency and accountability; examining the risks where they fall short is not an explicit part of each risk assessment. |
| MEASURE 2.9 | Explain, validate and document the model and interpret output in context | TEC-02 direct, RSK-08 partial, TEC-05 partial, TEC-06 partial | TEC-02 reference patterns, applied through design review, build in explainability and traceability of outputs; TEC-05 documents how each version works and its limits, TEC-06 validates against agreed criteria and RSK-08 explains outcomes to affected people. The explanation technique for each model is system-level. |
| MEASURE 2.10 | Examine and document privacy risk | RSK-03 direct, DAT-05 direct, SEC-04 partial | |
| MEASURE 2.11 | Evaluate fairness and bias and document the results | RSK-06 direct, MON-02 partial | RSK-06 defines groups at risk and fairness measures and tests before release, with results recorded; MON-02 monitors those fairness measures in live use. |
| MEASURE 2.12 | Assess the environmental impact of training and running AI | RSK-03 partial, OPM-02 partial, RSK-09 partial, MON-01 direct | MON-01 measures environmental footprint (such as energy, compute and water) for each use where material, with a baseline; RSK-03 includes environmental effects in the impact assessment, OPM-02 weighs footprint in sourcing and RSK-09 assesses supplier energy use and sustainability practice. |
| MEASURE 2.13 | Evaluate whether the testing and evaluation methods themselves work | TEC-06 direct, MON-05 partial | TEC-06 Level 3 reviews the testing approach and its metrics on a set cycle against live performance and incidents. |
| MEASURE 3.1 | Regularly identify and track existing, unexpected and emerging risks in live use | RSK-02 direct, MON-02 partial, MON-04 partial, MON-05 partial | RSK-02 Level 3 reassesses risk during live use and on material change; live monitoring catches unexpected behaviour (MON-02), incidents surface new risks (MON-04) and assurance reviews recur by risk tier (MON-05). |
| MEASURE 3.2 | Track risks that current metrics cannot measure | MON-01 direct, MON-05 partial | MON-01 Level 3 records risks that cannot yet be measured, with the indicators or proxies used to track them. |
| MEASURE 3.3 | Users and affected people can report problems and appeal, feeding evaluation | MON-06 partial, RSK-08 partial | Feedback routes (MON-06) and challenge with human review (RSK-08) give people a way to report and appeal; feeding what they raise into the system's evaluation measures is not explicit. |
| MEASURE 4.1 | Tie measurement to the deployment context, informed by domain experts and users | MON-01 partial, OPM-06 partial, CUL-03 partial | Measures are agreed for each use (MON-01), users are involved in delivery (OPM-06, CUL-03), and subject matter experts for the data and the work take part in design and evaluation (OPM-06). Still missing: a requirement that the MON-01 measures themselves are set with domain experts and end users for the deployment context. |
| MEASURE 4.2 | Validate live trustworthiness results with domain experts and AI actors | MON-02 partial, MON-05 partial, MON-06 partial | Live monitoring (MON-02), independent review (MON-05) and user feedback (MON-06) give the evidence; asking domain experts to confirm the system performs as intended in its setting is system-level and not explicit. |
| MEASURE 4.3 | Record performance gains or declines from field data and consultation | MON-02 partial, MON-06 partial, MON-03 partial | Drift and accuracy are monitored against thresholds (MON-02), feedback is reviewed (MON-06) and benefits tracked (MON-03); recording performance trends from field data and consultation with affected communities is not explicit. |
| MANAGE 1.1 | Decide whether the system meets its purpose and should proceed | POR-04 direct, POR-07 direct, GOV-03 partial | |
| MANAGE 1.2 | Prioritise risk treatment by impact, likelihood and resources | RSK-02 direct, RSK-01 partial | |
| MANAGE 1.3 | Plan and document responses to high-priority risks | RSK-02 direct | |
| MANAGE 1.4 | Document residual risks to downstream acquirers and end users | RSK-02 partial, TEC-05 partial, PPL-08 partial | RSK-02 Level 3 records residual risk for each use; TEC-05 documentation states known limitations and where not to rely on the AI, and PPL-08 tool guidance states residual security risks. Still missing: documenting residual risk in general for downstream acquirers and end users. |
| MANAGE 2.1 | Weigh risk management resources and non-AI alternatives | POR-05 partial, OPM-02 partial, STR-03 partial | The business case states options that include not using AI (POR-05), build or buy includes waiting (OPM-02) and funding is judged centrally (STR-03); weighing the cost of managing the risks for each use is not explicit. |
| MANAGE 2.2 | Sustain the value of deployed systems | MON-03 direct, OPM-07 partial, TEC-07 partial | |
| MANAGE 2.3 | Respond to and recover from a newly found risk | MON-09 direct, MON-04 partial, SEC-05 partial, OPM-09 partial | MON-09 Level 3 tells the supplier, and the regulator where the law requires, of a risk to health, safety or rights and suspends use if needed; MON-04 investigates and resolves incidents, SEC-05 handles security cases and OPM-09 keeps the service running or stops it safely. |
| MANAGE 2.4 | Assign responsibility and means to override, disengage or switch off a system | RSK-07 direct, OPM-09 partial, TEC-04 partial, TEC-05 partial | |
| MANAGE 3.1 | Monitor third-party AI risks and benefits regularly and apply controls | RSK-09 direct, OPM-05 partial, SEC-03 partial | RSK-09 Level 3 reassesses supplier AI risk on significant change and at set intervals, and its results feed the risk assessment for each use. |
| MANAGE 3.2 | Monitor pre-trained models as part of routine monitoring | MON-02 partial, TEC-07 partial, SEC-03 partial | Live monitoring covers the system (MON-02), TEC-07 keeps a bill of materials naming each model, and SEC-03 reassesses external models at set intervals and on disclosed vulnerabilities. Watching the underlying pre-trained model for upstream changes and for known issues other than security vulnerabilities is not explicit. |
| MANAGE 4.1 | Run post-deployment monitoring with feedback, appeal, override, incident and change routes | MON-02 direct, OPM-07 partial, MON-06 partial, RSK-08 partial, MON-04 partial, POR-09 partial | |
| MANAGE 4.2 | Build measurable improvement into system updates with stakeholder input | MON-06 partial, OPM-07 partial, MON-07 partial | Feedback is acted on (MON-06), changes are managed (OPM-07) and the governance system improves (MON-07); measurable improvement targets for each system's updates are system-level and not explicit. |
| MANAGE 4.3 | Tell relevant parties and affected people about incidents and track them | MON-09 direct, MON-04 partial, SEC-05 partial | MON-09 Level 3 sets routes for notifying suppliers and regulators of serious incidents and a plan for telling affected people; MON-04 tracks incidents through to resolution. |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.